Abstract

This paper describes experiences with software model checking after several years of using static analysis to nd errors. We initially thought that the trade-o between the two was clear: static analysis was easy but would mainly nd shallow bugs, while model checking would require more work but would be strictly better | it would nd more errors, the errors would be deeper, and the approach would be more powerful. These expectations were often wrong

Citations